Getting Data In

Retrieve original source value after override?

Explorer

I have overridden the source values from the default log file path to custom names like "AppLog", "MaintenanceLog", etc, through input.conf:

[monitor://F:\LOGS]
...
source = AppLogs
...

Is there a way to retrieve the original value of the source, F:\LOGS\my_original_log_file_name.log ?

Thanks in advance!

Tags (3)
0 Karma
1 Solution

Influencer

No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.

View solution in original post

0 Karma

Influencer

No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.

View solution in original post

0 Karma

Explorer

I was afraid that's the case too. Thanks for confirming ziegfried.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!